VulnerabilityModified

CVE-2006-5140

SQL injection vulnerability in display.php in Lappy512 PHP Krazy Image Host Script (phpkimagehost) 0.7a allows remote attackers to execute arbitrary SQL commands via the id parameter.

HIGH 7.5EPSS 1.12%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.12%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

SQL injection vulnerability in display.php in Lappy512 PHP Krazy Image Host Script (phpkimagehost) 0.7a allows remote attackers to execute arbitrary SQL commands via the id parameter.

CVSS 2.0: 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS: 1.12% probability · 64th percentile
CISA KEV: Not listed
Affected: lappy512/php krazy image host script
Source: cve@mitre.org

References

http://www.securityfocus.com/bid/20270Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/29270
https://www.exploit-db.com/exploits/2456
http://www.securityfocus.com/bid/20270Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/29270
https://www.exploit-db.com/exploits/2456

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.